Release 2018-09-24
Jump to navigation
Jump to search
Truxton 2.3.2.0
Improvements
- The Load Media desktop screen now has a "choose hash set" option that allows you to choose a hashset to use during a load.
- You can now download a hashset of an investigation or media. Please keep in mind that hashes with a value of all zeroes are not considered to be a valid hash.
- You can now specify individual hashset files for the load via the
-hashsetcommand line option. - USB device report now includes information from event logs.
- Connecting and disconnecting from networks is now displayed in the timeline.
- Better identification of search terms.
- Better filtering of document authors. Adobe will seemingly accept any series of bytes as an "author."
- New load option
-justcarveallows you to specify a file that will just be carved. No attempt to identify partition tables, file systems, or any other normal forensic processing will be performed. This is useful when you want to recover files from a disk image that has had the filesystem overwritten by a different file system. - Carved Zip fragment files now have names and dates.
- The globally unique identifier for media is now displayed in the media details section of the user interface. This makes it easier for people writing or using scripts.
- Better TAR file carving.
New File Types
- Blackberry Encrypted File
- Blackberry Master Key File
- MAME Configuration
- Microsoft Office Telemetry (User)
- Microsoft Office Telemetry (Solution)
- Microsoft Office Telemetry (Event)
Bug Fixes
- The
BumpMedia.ps1script now works for loads stuck in the 90+ percent range. This happens when machines are shut down during the final stage of processing. - Conversations view can now handle empty or blank accounts.
- Better parsing of plain and extended XRY XML files.
- Better parsing of Cellebrite 1.0 XML files.
- Parsing of ISO 8601 timestamps was being truncated at whole seconds. Now, sub-second resolution is supported.
- Searching for files by name didn't like spaces in them.
